General
-
Target
5df3470db00597e3da516459648dfa6a2c1564a57c1d51817d952beeeb860a2c.exe
-
Size
3.1MB
-
MD5
1c1a86dad78326429577ab0b7b7b5858
-
SHA1
cf9aeb9a02d368918d89fc69d55b38829ab83039
-
SHA256
5df3470db00597e3da516459648dfa6a2c1564a57c1d51817d952beeeb860a2c
-
SHA512
db9658604a62090fd69cbb7504bf320c947473dfdb10be9e7e866af0a47db228755c1ff8e740eacbe20481df71bc5527347c4185e831515b30ab91b07e46b204
-
SSDEEP
49152:SvnI22SsaNYfdPBldt698dBcjH9pg1JbLoGdwnTHHB72eh2NT:SvI22SsaNYfdPBldt6+dBcjH9p4
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.1.101:4782
Mutex
20f2b2b5-8392-4fbe-9585-0778c516b863
Attributes
-
encryption_key
3A9499E06EC8E749CF7AE8F7D466BD97D9B2380C
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
5df3470db00597e3da516459648dfa6a2c1564a57c1d51817d952beeeb860a2c.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections